https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:17:43 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-47703 <p>AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home&#39;s client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.</p> <p>AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home&#39;s client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.</p> https://db.gcve.eu/vuln/fkie_cve-2026-47703 https://db.gcve.eu/vuln/ghsa-xgx4-4h9w-53pv <p><strong>Affected:</strong> Go: github.com/AdguardTeam/AdGuardHome, Go: github.com/AdguardTeam/dnsproxy</p> <p>## Summary</p> <p>This report covers the client-triggered DoQ forwarding path in:</p> <p>- `dnsproxy` `v0.81.2` (`adguard/dnsproxy:v0.81.2`) - `AdGuard Home` `v0.107.74` (`adguard/adguardhome:latest`, image version label `v0.107.74`)</p> <p>The issue was reproduced on `2026-04-25` with the products configured through their documented DoQ listener and plain UDP upstream surfaces. The scope is the internal backend UDP hop created when a DoQ query is forwarded to a `udp://` upstream.</p> <p>On that path, the backend DNS `ID` is not preserved as an independent source of entropy. For both products, the backend observer saw `dns_id=0` for every sampled client-triggered query on the tested path. Repeated reruns then showed the same `txid=0` behavior and the same positive source-port oracle on every sampled run. A separate quoted-port ICMP oracle distinguished the correct backend UDP source port from a wrong one with a stable, client-visible behavior change.</p> <p>Attached evidence:</p> <p>- `dnsproxy` oracle path on `v0.81.2`: [attachments/artifacts/g03/20260425T141500Z-g03-v0812/summary.txt](attachments/artifacts/g03/20260425T141500Z-g03-v0812/summary.txt) - `dnsproxy` `v0.81.2` repeatability: [attachments/artifacts/g03/repeatability-v0812.md](attachments/artifacts/g03/repeatability-v0812.md) - `dnsproxy` steering follow-up on `v0.81.2`: [attachments/artifacts/g04/20260425T141900Z-g04-v0812/summary.txt](attachments/artifacts/g04/20260425T141900Z-g04-v0812/summary.txt) - `AdGuard Home` oracle path: [attachments/arti…</p> <p><strong>Affected:</strong> Go: github.com/AdguardTeam/AdGuardHome, Go: github.com/AdguardTeam/dnsproxy</p> <p>## Summary</p> <p>This report covers the client-triggered DoQ forwarding path in:</p> <p>- `dnsproxy` `v0.81.2` (`adguard/dnsproxy:v0.81.2`) - `AdGuard Home` `v0.107.74` (`adguard/adguardhome:latest`, image version label `v0.107.74`)</p> <p>The issue was reproduced on `2026-04-25` with the products configured through their documented DoQ listener and plain UDP upstream surfaces. The scope is the internal backend UDP hop created when a DoQ query is forwarded to a `udp://` upstream.</p> <p>On that path, the backend DNS `ID` is not preserved as an independent source of entropy. For both products, the backend observer saw `dns_id=0` for every sampled client-triggered query on the tested path. Repeated reruns then showed the same `txid=0` behavior and the same positive source-port oracle on every sampled run. A separate quoted-port ICMP oracle distinguished the correct backend UDP source port from a wrong one with a stable, client-visible behavior change.</p> <p>Attached evidence:</p> <p>- `dnsproxy` oracle path on `v0.81.2`: [attachments/artifacts/g03/20260425T141500Z-g03-v0812/summary.txt](attachments/artifacts/g03/20260425T141500Z-g03-v0812/summary.txt) - `dnsproxy` `v0.81.2` repeatability: [attachments/artifacts/g03/repeatability-v0812.md](attachments/artifacts/g03/repeatability-v0812.md) - `dnsproxy` steering follow-up on `v0.81.2`: [attachments/artifacts/g04/20260425T141900Z-g04-v0812/summary.txt](attachments/artifacts/g04/20260425T141900Z-g04-v0812/summary.txt) - `AdGuard Home` oracle path: [attachments/arti…</p> https://db.gcve.eu/vuln/ghsa-xgx4-4h9w-53pv